@zintrust/trace 0.9.2 → 0.9.4

package/dist/ingest/TraceIngestGateway.js

@@ -0,0 +1,215 @@
+import { Env, ErrorFactory, Router, SignedRequest, useDatabase, } from '@zintrust/core';
+import { TraceConfig } from '../config.js';
+import { TraceStorage } from '../storage/index.js';
+const nonces = new Map();
+const nowMs = () => Date.now();
+const normalizePath = (value) => {
+    const trimmed = value.trim();
+    if (trimmed === '')
+        return '/zin/trace/write';
+    return trimmed.startsWith('/') ? trimmed : `/${trimmed}`;
+};
+const parseMiddleware = (value) => value
+    .split(',')
+    .map((entry) => entry.trim())
+    .filter((entry) => entry.length > 0);
+const appendSuffix = (path, suffix) => {
+    const base = normalizePath(path).replace(/\/+$/, '');
+    const tail = suffix.startsWith('/') ? suffix : `/${suffix}`;
+    return `${base}${tail}`;
+};
+const cleanupExpiredNonces = () => {
+    const current = nowMs();
+    for (const [nonceKey, expiresAt] of nonces.entries()) {
+        if (expiresAt <= current) {
+            nonces.delete(nonceKey);
+        }
+    }
+};
+const storeNonce = async (keyId, nonce, ttlMs) => {
+    cleanupExpiredNonces();
+    const nonceKey = `${keyId}:${nonce}`;
+    if (nonces.has(nonceKey))
+        return false;
+    nonces.set(nonceKey, nowMs() + Math.max(ttlMs, 1));
+    return true;
+};
+const getBodyRecord = (req) => {
+    const body = req.getBody?.() ?? req.body;
+    if (typeof body === 'object' && body !== null && !Array.isArray(body)) {
+        return body;
+    }
+    return {};
+};
+const getRawBody = (req) => {
+    const rawText = req.context['rawBodyText'];
+    if (typeof rawText === 'string')
+        return rawText;
+    return JSON.stringify(getBodyRecord(req));
+};
+const toIncomingHeaders = (req) => {
+    const headers = req.getHeaders();
+    const normalize = (value) => {
+        if (Array.isArray(value))
+            return value.join(',');
+        return value;
+    };
+    return {
+        'x-zt-key-id': normalize(headers['x-zt-key-id']),
+        'x-zt-timestamp': normalize(headers['x-zt-timestamp']),
+        'x-zt-nonce': normalize(headers['x-zt-nonce']),
+        'x-zt-body-sha256': normalize(headers['x-zt-body-sha256']),
+        'x-zt-signature': normalize(headers['x-zt-signature']),
+    };
+};
+const sendFailure = (res, status, code, message, details) => {
+    const payload = {
+        ok: false,
+        error: { code, message, details },
+    };
+    res.status(status).json(payload);
+};
+const sendSuccess = (res) => {
+    const payload = { ok: true };
+    res.status(200).json(payload);
+};
+const verifyRequest = async (req, bodyText, settings, path) => {
+    if (settings.keyId.trim() === '' || settings.secret.trim() === '') {
+        return {
+            ok: false,
+            code: 'CONFIG_ERROR',
+            status: 500,
+            message: 'Trace ingest signing credentials are not configured',
+        };
+    }
+    const verifyResult = await SignedRequest.verify({
+        method: req.getMethod(),
+        url: new URL(path, 'http://localhost'),
+        body: bodyText,
+        headers: toIncomingHeaders(req),
+        nowMs: nowMs(),
+        windowMs: settings.signingWindowMs,
+        verifyNonce: async (keyId, nonce) => storeNonce(keyId, nonce, settings.nonceTtlMs),
+        getSecretForKeyId: async (keyId) => {
+            if (keyId === settings.keyId)
+                return settings.secret;
+            return undefined;
+        },
+    });
+    if (verifyResult.ok === true)
+        return { ok: true };
+    return {
+        ok: false,
+        code: verifyResult.code,
+        status: verifyResult.code === 'EXPIRED' || verifyResult.code === 'REPLAYED' ? 401 : 403,
+        message: verifyResult.message,
+    };
+};
+const createWriteHandler = (settings, path) => {
+    return async (req, res) => {
+        const body = getBodyRecord(req);
+        const auth = await verifyRequest(req, getRawBody(req), settings, path);
+        if (auth.ok === false) {
+            sendFailure(res, auth.status, auth.code, auth.message);
+            return;
+        }
+        const entry = body['entry'];
+        if (typeof entry !== 'object' || entry === null || Array.isArray(entry)) {
+            sendFailure(res, 400, 'VALIDATION_ERROR', 'entry must be an object');
+            return;
+        }
+        await settings.storage.writeEntry(entry);
+        sendSuccess(res);
+    };
+};
+const createUpdateHandler = (settings, path) => {
+    return async (req, res) => {
+        const body = getBodyRecord(req);
+        const auth = await verifyRequest(req, getRawBody(req), settings, path);
+        if (auth.ok === false) {
+            sendFailure(res, auth.status, auth.code, auth.message);
+            return;
+        }
+        const uuid = body['uuid'];
+        const patch = body['patch'];
+        if (typeof uuid !== 'string' || uuid.trim() === '') {
+            sendFailure(res, 400, 'VALIDATION_ERROR', 'uuid is required');
+            return;
+        }
+        if (typeof patch !== 'object' || patch === null || Array.isArray(patch)) {
+            sendFailure(res, 400, 'VALIDATION_ERROR', 'patch must be an object');
+            return;
+        }
+        await settings.storage.updateEntry(uuid, patch);
+        sendSuccess(res);
+    };
+};
+const createMarkFamilyStaleHandler = (settings, path) => {
+    return async (req, res) => {
+        const body = getBodyRecord(req);
+        const auth = await verifyRequest(req, getRawBody(req), settings, path);
+        if (auth.ok === false) {
+            sendFailure(res, auth.status, auth.code, auth.message);
+            return;
+        }
+        const familyHash = body['familyHash'];
+        const exceptUuid = body['exceptUuid'];
+        if (typeof familyHash !== 'string' || familyHash.trim() === '') {
+            sendFailure(res, 400, 'VALIDATION_ERROR', 'familyHash is required');
+            return;
+        }
+        if (typeof exceptUuid !== 'string' || exceptUuid.trim() === '') {
+            sendFailure(res, 400, 'VALIDATION_ERROR', 'exceptUuid is required');
+            return;
+        }
+        await settings.storage.markFamilyStale(familyHash, exceptUuid);
+        sendSuccess(res);
+    };
+};
+const resolveStorage = (overrides) => {
+    if (overrides?.storage !== undefined)
+        return overrides.storage;
+    const connectionName = overrides?.connectionName ?? TraceConfig.merge().connection;
+    const db = useDatabase(undefined, connectionName);
+    if (db === undefined) {
+        throw ErrorFactory.createConfigError('Trace ingest connection is not configured.', {
+            connectionName,
+            envKey: 'TRACE_DB_CONNECTION',
+        });
+    }
+    return TraceStorage.resolveStorage(db);
+};
+const readSettings = (overrides) => {
+    const configuredSecret = (overrides?.secret ?? Env.get('TRACE_PROXY_SECRET', '')).trim();
+    const configuredKeyId = (overrides?.keyId ?? Env.get('TRACE_PROXY_KEY_ID', '')).trim();
+    return {
+        basePath: normalizePath(overrides?.basePath ?? Env.get('TRACE_PROXY_PATH', '/zin/trace/write')),
+        keyId: configuredKeyId === '' ? (Env.APP_NAME || 'zintrust').trim() : configuredKeyId,
+        secret: configuredSecret === '' ? Env.APP_KEY : configuredSecret,
+        signingWindowMs: overrides?.signingWindowMs ?? Env.getInt('TRACE_PROXY_SIGNING_WINDOW_MS', 60000),
+        nonceTtlMs: overrides?.nonceTtlMs ?? Env.getInt('TRACE_PROXY_NONCE_TTL_MS', 120000),
+        middleware: overrides?.middleware ?? parseMiddleware(Env.get('TRACE_PROXY_MIDDLEWARE', '')),
+        storage: resolveStorage(overrides),
+    };
+};
+export const TraceIngestGateway = Object.freeze({
+    create(overrides) {
+        const settings = readSettings(overrides);
+        const routeOptions = settings.middleware.length > 0
+            ? { middleware: settings.middleware }
+            : undefined;
+        const updatePath = appendSuffix(settings.basePath, '/update');
+        const markFamilyStalePath = appendSuffix(settings.basePath, '/mark-family-stale');
+        return {
+            registerRoutes(router) {
+                Router.post(router, settings.basePath, createWriteHandler(settings, settings.basePath), routeOptions);
+                Router.post(router, updatePath, createUpdateHandler(settings, updatePath), routeOptions);
+                Router.post(router, markFamilyStalePath, createMarkFamilyStaleHandler(settings, markFamilyStalePath), routeOptions);
+            },
+        };
+    },
+});
+export const registerTraceIngestGateway = (router, overrides) => {
+    TraceIngestGateway.create(overrides).registerRoutes(router);
+};
+export default TraceIngestGateway;

package/dist/register.js

@@ -21,13 +21,13 @@
  */
 import { TraceConfig } from './config.js';
 import { TraceContext } from './context.js';
-import { TraceStorage } from './storage/index.js';
+import { ProxyTraceStorage, TraceServiceTag, TraceStorage } from './storage/index.js';
 import { TraceContentBudget } from './storage/TraceContentBudget.js';
 import { TraceContentRedaction } from './storage/TraceContentRedaction.js';
 import { TraceEntryFiltering } from './storage/TraceEntryFiltering.js';
 import { TraceWriteDiagnostics } from './storage/TraceWriteDiagnostics.js';
+import { assertTraceConnectionResolved, assertTraceStorageReady, resolveObservedConnectionName, resolveTraceConnectionName, } from './TraceConnection.js';
 const globalTraceRegisterState = globalThis;
-globalTraceRegisterState.__zintrust_system_trace_plugin_requested__ = true;
 const traceAlreadyInitialized = globalTraceRegisterState.__zintrust_system_trace_register_initialized__ === true;
 if (!traceAlreadyInitialized) {
     globalTraceRegisterState.__zintrust_system_trace_register_initialized__ = true;
@@ -40,11 +40,6 @@ const importCore = async () => {
         return {};
     }
 };
-const TRACE_REQUIRED_TABLES = [
-    'zin_trace_entries',
-    'zin_trace_entries_tags',
-    'zin_trace_monitoring',
-];
 const resolveRegisterMiddleware = () => {
     const globalMiddlewareRegistrarState = globalThis;
     return (middleware) => {
@@ -57,30 +52,6 @@ const resolveRegisterMiddleware = () => {
         globalMiddlewareRegistrarState.__zintrust_pending_global_middlewares__.push(middleware);
     };
 };
-const resolveTraceConnectionName = (env, configuredConnection) => {
-    const resolveDefaultConnection = () => {
-        const defaultConnection = env?.get('DB_CONNECTION', '').trim() ?? '';
-        if (defaultConnection === '' || defaultConnection === 'default')
-            return 'default';
-        return defaultConnection;
-    };
-    const explicitConnection = configuredConnection?.trim();
-    if (explicitConnection !== undefined && explicitConnection !== '') {
-        return explicitConnection === 'default' ? resolveDefaultConnection() : explicitConnection;
-    }
-    return resolveDefaultConnection();
-};
-const resolveObservedConnectionName = (env, configuredObservedConnection, storageConnectionName) => {
-    if (typeof configuredObservedConnection === 'string' &&
-        configuredObservedConnection.trim() !== '') {
-        return resolveTraceConnectionName(env, configuredObservedConnection);
-    }
-    const defaultConnectionName = resolveTraceConnectionName(env);
-    if (storageConnectionName !== defaultConnectionName) {
-        return defaultConnectionName;
-    }
-    return storageConnectionName;
-};
 const isObjectValue = (value) => {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 };
@@ -160,43 +131,6 @@ const buildTraceRedactionOverrides = (input) => {
         ? redaction
         : undefined;
 };
-const createTraceConfigError = (coreApi, message, details) => {
-    if (coreApi.ErrorFactory?.createConfigError !== undefined) {
-        return coreApi.ErrorFactory.createConfigError(message, details);
-    }
-    const error = new globalThis.Error(message);
-    error.name = 'ConfigError';
-    error.code = 'CONFIG_ERROR';
-    error.statusCode = 500;
-    error.details = details;
-    return error;
-};
-function assertTraceConnectionResolved(coreApi, db, params) {
-    if (db !== undefined) {
-        return;
-    }
-    throw createTraceConfigError(coreApi, `Trace connection "${params.connectionName}" could not be resolved.`, {
-        connectionName: params.connectionName,
-        envKey: params.envKey,
-        hint: params.envKey === 'TRACE_DB_CONNECTION'
-            ? 'Configure TRACE_DB_CONNECTION to an existing database connection before enabling TRACE_ENABLED.'
-            : 'Configure TRACE_QUERY_CONNECTION, or ensure DB_CONNECTION resolves to an existing database connection.',
-    });
-}
-const assertTraceStorageReady = async (coreApi, db, connectionName) => {
-    try {
-        await Promise.all(TRACE_REQUIRED_TABLES.map(async (table) => {
-            await db.queryOne(`SELECT 1 AS ok FROM ${table} LIMIT 1`, []);
-        }));
-    }
-    catch (error) {
-        throw createTraceConfigError(coreApi, `Trace storage connection "${connectionName}" is not ready. Create the database if needed and run \`zin migrate:trace\` before enabling TRACE_ENABLED.`, {
-            connectionName,
-            error,
-            requiredTables: [...TRACE_REQUIRED_TABLES],
-        });
-    }
-};
 const core = (await importCore());
 const Env = core.Env;
 const startupOverrides = await resolveTraceStartupOverrides(core);
@@ -208,6 +142,15 @@ if (!traceAlreadyInitialized && Env) {
         const pruneAfterHoursRaw = Env.get('TRACE_PRUNE_HOURS', '').trim();
         const slowQueryThresholdRaw = Env.get('TRACE_SLOW_QUERY_MS', '').trim();
         const logMinLevelRaw = Env.get('TRACE_LOG_LEVEL', '').trim();
+        const traceProxyRaw = Env.get('TRACE_PROXY', '').trim();
+        const traceProxyUrlRaw = Env.get('TRACE_PROXY_URL', '').trim();
+        const traceProxyPathRaw = Env.get('TRACE_PROXY_PATH', '').trim();
+        const traceProxyKeyIdRaw = Env.get('TRACE_PROXY_KEY_ID', '').trim();
+        const traceProxySecretRaw = Env.get('TRACE_PROXY_SECRET', '').trim();
+        const traceProxyTimeoutRaw = Env.get('TRACE_PROXY_TIMEOUT_MS', '').trim();
+        const traceServiceTagRaw = Env.get('TRACE_SERVICE_TAG', '').trim();
+        const appNameRaw = Env.get('APP_NAME', '').trim();
+        const appKeyRaw = Env.get('APP_KEY', '').trim();
         const captureCachePayloadsRaw = Env.get('TRACE_CACHE_PAYLOADS', '').trim();
         const captureQueryBindingsRaw = Env.get('TRACE_QUERY_BINDINGS', '').trim();
         const contentDispatchDriverRaw = Env.get('TRACE_CONTENT_QUEUE_DRIVER', '').trim();
@@ -232,6 +175,21 @@ if (!traceAlreadyInitialized && Env) {
         const logMinLevel = (logMinLevelRaw === '' ? startupOverrides?.logMinLevel : logMinLevelRaw);
         const captureCachePayloads = parseEnvBool(captureCachePayloadsRaw) ?? startupOverrides?.captureCachePayloads;
         const captureQueryBindings = parseEnvBool(captureQueryBindingsRaw) ?? startupOverrides?.captureQueryBindings;
+        const traceProxyEnabled = parseEnvBool(traceProxyRaw) ?? startupOverrides?.proxy?.enabled;
+        const traceProxyUrl = traceProxyUrlRaw === '' ? startupOverrides?.proxy?.url : traceProxyUrlRaw;
+        const traceProxyPath = traceProxyPathRaw === '' ? startupOverrides?.proxy?.path : traceProxyPathRaw;
+        const traceProxyKeyId = traceProxyKeyIdRaw === ''
+            ? (startupOverrides?.proxy?.keyId ?? appNameRaw)
+            : traceProxyKeyIdRaw;
+        const traceProxySecret = traceProxySecretRaw === ''
+            ? (startupOverrides?.proxy?.secret ?? appKeyRaw)
+            : traceProxySecretRaw;
+        const traceProxyTimeout = traceProxyTimeoutRaw === ''
+            ? startupOverrides?.proxy?.timeoutMs
+            : Number.parseInt(traceProxyTimeoutRaw, 10);
+        const traceServiceTag = traceServiceTagRaw === ''
+            ? (startupOverrides?.serviceTag ?? appNameRaw).trim() || undefined
+            : traceServiceTagRaw;
         const contentDispatchDriver = contentDispatchDriverRaw === ''
             ? startupOverrides?.contentDispatch?.driver
             : contentDispatchDriverRaw;
@@ -267,6 +225,29 @@ if (!traceAlreadyInitialized && Env) {
             enabled,
             connection,
             observeConnection,
+            ...(typeof traceServiceTag === 'string' && traceServiceTag !== ''
+                ? { serviceTag: traceServiceTag }
+                : {}),
+            proxy: {
+                ...TraceConfig.defaults().proxy,
+                ...startupOverrides?.proxy,
+                ...(typeof traceProxyEnabled === 'boolean' ? { enabled: traceProxyEnabled } : {}),
+                ...(typeof traceProxyUrl === 'string' && traceProxyUrl !== ''
+                    ? { url: traceProxyUrl }
+                    : {}),
+                ...(typeof traceProxyPath === 'string' && traceProxyPath !== ''
+                    ? { path: traceProxyPath }
+                    : {}),
+                ...(typeof traceProxyKeyId === 'string' && traceProxyKeyId !== ''
+                    ? { keyId: traceProxyKeyId }
+                    : {}),
+                ...(typeof traceProxySecret === 'string' && traceProxySecret !== ''
+                    ? { secret: traceProxySecret }
+                    : {}),
+                ...(typeof traceProxyTimeout === 'number' && Number.isFinite(traceProxyTimeout)
+                    ? { timeoutMs: traceProxyTimeout }
+                    : {}),
+            },
             ...(typeof pruneAfterHours === 'number' && Number.isFinite(pruneAfterHours)
                 ? { pruneAfterHours }
                 : {}),
@@ -330,7 +311,16 @@ if (!traceAlreadyInitialized && Env) {
             envKey: 'TRACE_QUERY_CONNECTION',
         });
         await assertTraceStorageReady(core, storageDb, resolvedConnectionName);
-        const storage = TraceWriteDiagnostics.wrapStorage(TraceContentBudget.wrapStorage(TraceContentRedaction.wrapStorage(TraceEntryFiltering.wrapStorage(TraceStorage.resolveStorage(storageDb), config), config.redaction), config), {
+        const resolvedStorage = config.proxy.enabled
+            ? ProxyTraceStorage.create({
+                baseUrl: config.proxy.url ?? '',
+                path: config.proxy.path,
+                keyId: config.proxy.keyId ?? '',
+                secret: config.proxy.secret ?? '',
+                timeoutMs: config.proxy.timeoutMs,
+            })
+            : TraceStorage.resolveStorage(storageDb);
+        const storage = TraceWriteDiagnostics.wrapStorage(TraceContentBudget.wrapStorage(TraceContentRedaction.wrapStorage(TraceEntryFiltering.wrapStorage(TraceServiceTag.wrapStorage(resolvedStorage, config), config), config.redaction), config), {
             connectionName: resolvedConnectionName,
             logger: core.Logger,
         });

package/dist/storage/ProxyTraceStorage.d.ts

@@ -0,0 +1,12 @@
+import type { ITraceStorage } from '../types';
+type ProxyTraceStorageSettings = {
+    baseUrl: string;
+    path: string;
+    keyId: string;
+    secret: string;
+    timeoutMs: number;
+};
+export declare const ProxyTraceStorage: Readonly<{
+    create(settings: ProxyTraceStorageSettings): ITraceStorage;
+}>;
+export default ProxyTraceStorage;

package/dist/storage/ProxyTraceStorage.js

@@ -0,0 +1,102 @@
+import { ErrorFactory, RemoteSignedJson } from '@zintrust/core';
+const ensureConfigured = (settings) => {
+    if (settings.baseUrl.trim() === '') {
+        throw ErrorFactory.createConfigError('TRACE_PROXY_URL is required when TRACE_PROXY=true');
+    }
+    if (settings.keyId.trim() === '' || settings.secret.trim() === '') {
+        throw ErrorFactory.createConfigError('TRACE_PROXY signing credentials are required when TRACE_PROXY=true');
+    }
+};
+const normalizePath = (value) => {
+    const trimmed = value.trim();
+    if (trimmed === '')
+        return '/zin/trace/write';
+    return trimmed.startsWith('/') ? trimmed : `/${trimmed}`;
+};
+const createUnsupportedReadError = () => ErrorFactory.createConfigError('Trace proxy sender storage does not expose dashboard/query operations. Use the trace server for reads.');
+const buildSettings = (settings) => {
+    ensureConfigured(settings);
+    const normalizedPath = normalizePath(settings.path);
+    return {
+        baseUrl: settings.baseUrl,
+        keyId: settings.keyId,
+        secret: settings.secret,
+        timeoutMs: settings.timeoutMs,
+        signaturePathPrefixToStrip: new URL(settings.baseUrl).pathname,
+        missingUrlMessage: 'TRACE_PROXY_URL is required when TRACE_PROXY=true',
+        missingCredentialsMessage: 'TRACE_PROXY signing credentials are required when TRACE_PROXY=true',
+        messages: {
+            unauthorized: 'Trace proxy rejected the request credentials',
+            forbidden: 'Trace proxy rejected the request signature',
+            rateLimited: 'Trace proxy rate-limited the request',
+            rejected: 'Trace proxy rejected the request payload',
+            error: 'Trace proxy request failed',
+            timedOut: 'Trace proxy request timed out',
+        },
+        normalizedPath,
+    };
+};
+const appendSuffix = (path, suffix) => {
+    const base = normalizePath(path).replace(/\/+$/, '');
+    const tail = suffix.startsWith('/') ? suffix : `/${suffix}`;
+    return `${base}${tail}`;
+};
+const unsupportedQueryEntries = async () => {
+    throw createUnsupportedReadError();
+};
+const unsupportedGetEntry = async () => {
+    throw createUnsupportedReadError();
+};
+const unsupportedGetBatch = async () => {
+    throw createUnsupportedReadError();
+};
+const unsupportedQueryBatchEntries = async () => {
+    throw createUnsupportedReadError();
+};
+const unsupportedPrune = async () => {
+    throw createUnsupportedReadError();
+};
+const unsupportedClear = async () => {
+    throw createUnsupportedReadError();
+};
+const unsupportedGetMonitoring = async () => {
+    throw createUnsupportedReadError();
+};
+const unsupportedAddMonitoring = async () => {
+    throw createUnsupportedReadError();
+};
+const unsupportedRemoveMonitoring = async () => {
+    throw createUnsupportedReadError();
+};
+const unsupportedStats = async () => {
+    throw createUnsupportedReadError();
+};
+export const ProxyTraceStorage = Object.freeze({
+    create(settings) {
+        const normalized = buildSettings(settings);
+        return Object.freeze({
+            async writeEntry(entry) {
+                await RemoteSignedJson.request(normalized, normalized.normalizedPath, {
+                    entry,
+                });
+            },
+            async updateEntry(uuid, patch) {
+                await RemoteSignedJson.request(normalized, appendSuffix(normalized.normalizedPath, '/update'), { uuid, patch });
+            },
+            async markFamilyStale(familyHash, exceptUuid) {
+                await RemoteSignedJson.request(normalized, appendSuffix(normalized.normalizedPath, '/mark-family-stale'), { familyHash, exceptUuid });
+            },
+            queryEntries: unsupportedQueryEntries,
+            getEntry: unsupportedGetEntry,
+            getBatch: unsupportedGetBatch,
+            queryBatchEntries: unsupportedQueryBatchEntries,
+            prune: unsupportedPrune,
+            clear: unsupportedClear,
+            getMonitoring: unsupportedGetMonitoring,
+            addMonitoring: unsupportedAddMonitoring,
+            removeMonitoring: unsupportedRemoveMonitoring,
+            stats: unsupportedStats,
+        });
+    },
+});
+export default ProxyTraceStorage;

package/dist/storage/TraceContentBudget.js

@@ -179,6 +179,7 @@ const getCoreRuntime = async () => {
 };
 const getQueueWorkerApi = async () => {
     try {
+        // @ts-ignore
         const mod = (await import('@zintrust/workers'));
         return typeof mod.createQueueWorker === 'function' ? mod : null;
     }

package/dist/storage/TraceServiceTag.d.ts

@@ -0,0 +1,5 @@
+import type { ITraceConfig, ITraceStorage } from '../types';
+export declare const TraceServiceTag: Readonly<{
+    wrapStorage(storage: ITraceStorage, config: ITraceConfig): ITraceStorage;
+}>;
+export default TraceServiceTag;

package/dist/storage/TraceServiceTag.js

@@ -0,0 +1,43 @@
+import { ErrorFactory } from '@zintrust/core';
+const appendServiceTag = (entry, serviceTag) => {
+    const normalizedTag = serviceTag?.trim() ?? '';
+    if (normalizedTag === '' || entry.tags.includes(normalizedTag)) {
+        return entry;
+    }
+    return {
+        ...entry,
+        tags: [...entry.tags, normalizedTag],
+    };
+};
+const unsupportedRead = async () => {
+    throw ErrorFactory.createConfigError('Trace proxy mode only supports runtime persistence on the sender. Query the trace server database or dashboard directly.');
+};
+const bindOrUnsupported = (method) => {
+    if (method === undefined) {
+        return unsupportedRead;
+    }
+    return method;
+};
+export const TraceServiceTag = Object.freeze({
+    wrapStorage(storage, config) {
+        const writeEntry = async (entry) => {
+            await storage.writeEntry(appendServiceTag(entry, config.serviceTag));
+        };
+        return Object.freeze({
+            writeEntry,
+            updateEntry: storage.updateEntry.bind(storage),
+            markFamilyStale: storage.markFamilyStale.bind(storage),
+            queryEntries: bindOrUnsupported(storage.queryEntries?.bind(storage)),
+            getEntry: bindOrUnsupported(storage.getEntry?.bind(storage)),
+            getBatch: bindOrUnsupported(storage.getBatch?.bind(storage)),
+            queryBatchEntries: bindOrUnsupported(storage.queryBatchEntries?.bind(storage)),
+            prune: bindOrUnsupported(storage.prune?.bind(storage)),
+            clear: bindOrUnsupported(storage.clear?.bind(storage)),
+            getMonitoring: bindOrUnsupported(storage.getMonitoring?.bind(storage)),
+            addMonitoring: bindOrUnsupported(storage.addMonitoring?.bind(storage)),
+            removeMonitoring: bindOrUnsupported(storage.removeMonitoring?.bind(storage)),
+            stats: bindOrUnsupported(storage.stats?.bind(storage)),
+        });
+    },
+});
+export default TraceServiceTag;

package/dist/storage/index.d.ts

@@ -1,2 +1,4 @@
 export { TraceStorage } from './TraceStorage';
 export type { ITraceStorage } from './TraceStorage';
+export { ProxyTraceStorage } from './ProxyTraceStorage';
+export { TraceServiceTag } from './TraceServiceTag';

package/dist/storage/index.js

@@ -1 +1,3 @@
 export { TraceStorage } from './TraceStorage.js';
+export { ProxyTraceStorage } from './ProxyTraceStorage.js';
+export { TraceServiceTag } from './TraceServiceTag.js';

package/dist/types.d.ts

@@ -316,6 +316,14 @@ export type TraceContentDispatchConfig = {
     enqueueTimeoutMs: number;
     worker: TraceContentDispatchWorkerConfig;
 };
+export type TraceProxyConfig = {
+    enabled: boolean;
+    url?: string;
+    path: string;
+    keyId?: string;
+    secret?: string;
+    timeoutMs: number;
+};
 export type TraceWatcherToggle = boolean | TraceFilterRule;
 export type TraceRequestWatcherToggle = boolean | TraceRequestWatcherConfig;
 export type TraceClientRequestWatcherToggle = boolean | TraceClientRequestWatcherConfig;
@@ -345,6 +353,8 @@ export interface ITraceConfig {
     enabled: boolean;
     connection?: string;
     observeConnection?: string;
+    serviceTag?: string;
+    proxy: TraceProxyConfig;
     pruneAfterHours: number;
     ignoreRoutes: string[];
     ignorePaths: string[];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zintrust/trace",
-  "version": "0.9.2",
+  "version": "0.9.4",
   "description": "Trace assistant for ZinTrust: logs requests, queries, exceptions, jobs, and more.",
   "private": false,
   "type": "module",
@@ -40,7 +40,7 @@
     "node": ">=20.0.0"
   },
   "peerDependencies": {
-    "@zintrust/core": "^0.9.2"
+    "@zintrust/core": "^0.9.4"
   },
   "publishConfig": {
     "access": "public"
@@ -56,4 +56,4 @@
     "build": "tsc -p tsconfig.json && tsc -p tsconfig.migrations.json && node ../../scripts/fix-dist-esm-imports.mjs dist",
     "prepublishOnly": "npm run build"
   }
-}
+}